Researchers reveal VoIP vulnerabilities

Share this article:
VoIPshield Laboratories has alerted companies that market voice over IP systems of new security vulnerabilities.

The VoIP vulnerabilities, if successfully exploited, could affect brand reputation, internal productivity, and competitive advantage, researchers said.

VoIPshield does not reveal specifics about the vulnerabilities to the public, Bogdan Materna, VoIPshield Laboratories chief technology officer, told SCMagazineUS.com on Friday.

“We don't want to give hackers information to work from,” he said.

Instead, under its disclosure policy, VoIPshield works with the VoIP vendors to assist them in reproducing the vulnerabilities in their labs.

VoIPshield classifies the vulnerabilities into different categories -- remote code execution; unauthorized access; denial of service; and information harvesting – and rates them according to their severity.

Materna said that by passing the information of their vulnerability research, the company hopes that vendors will be able to take action to create patches for potential exploits. Avaya, Cisco and Nortel have acknowledged the latest vulnerabilities on their websites, and are issuing their own security advisories.

VoIP vulnerabilities appear to be increasing because more security researchers are focused on finding them, Lawrence Orans of Gartner told SCMagazineUS.com.

“Three to four years ago, there was far less focus on IP telephony vulnerabilities because the IP telephony installed base was much smaller,” Orans said. "In 2008, most of the widely deployed telephony systems have vulnerabilities that permit DOS attacks, privilege escalation and code execution attacks."

Because of these risks, he added, managers should scan their applications for vulnerabilities on a regular basis and prioritize software patches that resolve critical vulnerabilities.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Researchers observe more than a hundred connections to 'Backoff' sinkhole

Researchers with Kaspersky Lab were able to sinkhole two command-and-control servers used by certain Backoff point-of-sale malware samples.

Judge lifts stay but Microsoft won't hand over emails during appeal

A judge has lifted a suspension of a previous order compelling Microsoft to hand over customer emails stored on a server in Ireland.

Home Depot investigates possible payment card breach

Home Depot investigates possible payment card breach

Home Depot said on Tuesday that it is working with its banking partners and law enforcement to investigate a possible data breach.